Routes advertised to on-prem via VPN

Hello.

For site-to-site VPNs with virtual private gateways, I believe only the CIDR of the VPC associated with the virtual private gateway is routed to on-premises using BGP.
If you use TransitGateway to connect a customer gateway with Site to Site VPC, the CIDR propagated to the TraisitGateway route table will be advertised to the on-premises route using BGP.

To add on what Riku_Kobayashi has noted: What you were running into is transitive routing issues. Transit Gateway is a solution for transitive routing in this case - you connect your VPCs and VPN to the TGW, and the TGW routes the traffic to the various destinations based on it's routing table.

You should associate any VPCs or VPNs you want traffic to be able to reach to your TGW, and then ensure there are routes in the TGW routing table to direct traffic to the desired CIDRs/destinations.

Some additional information on transitive routing through VPC peering: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html#vpc-peering-basics-multiple

And some information on how Transit Gateway works for resource attachment and routing: https://docs.aws.amazon.com/vpc/latest/tgw/how-transit-gateways-work.html

Hope this helps!

I created a Transit Gateway VPN attachment as follows: Should 10.2.0.0/24 be advertised to on-prem ?

thanks !!